POPIA Notice and Consent

1. Responsible party and Information Officer

• Responsible party: Deal Match (Pty) Ltd
• Information Officer: the Managing Director
• Email: paul@dealmatch.africa
• Telephone: 071 862 0256
• Country of operation: Republic of South Africa

2. Information collected and the source

We collect Personal Information directly from you through our forms, portals and communications. We may also receive information about you from Partners, credit bureaux (where you have authorised a check), fraud prevention services and publicly available sources.

The categories collected are set out in full in section 2 and section 3 of our Privacy Policy.

3. Purpose of collection

• To understand your vehicle, finance, trade-in or insurance requirement.
• To match that requirement with suitable Partners and to transmit it to them.
• To allow Partners to contact you with offers, quotations and questions.
• To track the progress of your requirement and communicate with you about it.
• To prevent fraud, verify identity and secure the Platform.
• To comply with legal and regulatory obligations.
• To improve our service, using de-identified or aggregated data where possible.

4. Whether provision is voluntary or mandatory

Providing your information is voluntary. However, certain fields are mandatory for us to render the service, and without them we cannot match your requirement. Fields marked optional may be omitted without consequence.

5. Consequences of not providing information

If you do not provide the mandatory information, we will be unable to transmit your requirement to Partners, Partners will be unable to quote or assess an application, and you will not receive offers.

6. Lawful basis for processing

We process your Personal Information on one or more of the following bases in section 11 of POPIA: your consent; the necessity of processing to conclude or perform a contract with you; compliance with a legal obligation; the protection of your legitimate interests; and the pursuit of our or a third party's legitimate interests, balanced against your rights.

7. Specific consents you give on our forms

Each consent is specific, informed and voluntary, and may be withdrawn at any time by writing to paul@dealmatch.africa. Withdrawal does not affect processing already lawfully carried out, and does not oblige a Partner who already holds your information to delete it — you must approach that Partner directly.

• Dealer consent: you consent to Deal Match sharing your information with relevant dealerships for the purpose of matching your vehicle requirement.
• Insurance consent: where you request insurance assistance, you consent to your information being shared with licensed insurance partners so that they may provide suitable options.
• Credit consent: where you request finance or refinance, you consent to your information being shared with registered credit providers who may, with your separate authorisation, perform credit bureau enquiries.
• Partner consent: where you apply to join the network, you consent to us verifying your business details, licensing and references.

8. Recipients of your information

Recipients are listed in section 6 of our Privacy Policy and include dealerships, credit providers, insurers and brokers, operators acting under written contract, professional advisers, and regulators or courts where legally required.

9. Cross-border transfers

Where Personal Information is transferred outside South Africa, we comply with section 72 of POPIA by ensuring the recipient is bound by a law, binding corporate rules or a written agreement affording an adequate level of protection substantially similar to POPIA.

10. Security safeguards

We apply appropriate, reasonable technical and organisational measures under section 19 of POPIA to prevent loss, damage, unauthorised destruction, and unlawful access to or processing of Personal Information. Operators are contractually bound to equivalent standards and to notify us immediately of any compromise.

11. Retention and destruction

We retain Personal Information only for as long as necessary for the purposes described, or as required by law. The applicable retention periods are set out in section 10 of our Privacy Policy. On expiry, records are deleted, destroyed or de-identified.

12. Automated decision-making

Our matching logic uses rules such as province, budget, brand and stock availability to decide which Partners receive your requirement. This is not a decision that produces legal consequences for you, and it does not determine whether credit is granted. Credit and underwriting decisions are made by Partners.

13. Your rights as a data subject

• Access: request confirmation of what we hold and a copy of it.
• Correction: request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information.
• Objection: object to processing based on legitimate interests, on reasonable grounds.
• Withdrawal: withdraw consent at any time.
• Direct marketing: opt out at any time, free of charge.
• Complaint: submit a complaint to the Information Regulator.
• Civil action: institute civil proceedings for a breach of POPIA.

14. How to exercise a right

Email paul@dealmatch.africa with the words "POPIA request" in the subject line and describe the right you wish to exercise. We may require proof of identity before acting. Access requests are processed under the Promotion of Access to Information Act 2 of 2000 using Form 2, and a prescribed fee may apply. We respond within 30 days unless an extension is permitted.

15. Complaints to the Information Regulator

• Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Complaints: complaints.IR@justice.gov.za
• Enquiries: inforeg@justice.gov.za

16. Updates to this notice

We may update this notice as our processing changes or as guidance from the Information Regulator develops. The current version is always published on this page with the date of last update.

17. The consent you are giving

When you tick the consent statement on a Deal Match form, you confirm that you have read this notice and that you consent to the following, freely and voluntarily:

• that we may process the personal information you submit for the purpose of matching your requirement;
• that we may share that information with verified dealerships and, where you have asked for finance or insurance, with registered credit providers, insurers and authorised brokers;
• that those Partners may contact you by phone, email, SMS or WhatsApp about your requirement;
• that a credit provider may, where you apply for finance, conduct affordability and credit-bureau enquiries as required by the National Credit Act;
• that we may store your information for the retention periods set out in our Privacy Policy.

18. Withdrawing consent

You may withdraw your consent at any time, without giving a reason and at no cost, by emailing us with "Withdraw consent" in the subject line. Withdrawal is not retrospective: processing carried out lawfully before withdrawal remains lawful, and it does not affect processing we are obliged to continue in order to comply with a legal obligation or to defend a legal claim.

Once you withdraw, we stop matching your requirement and mark your record as inactive. Partners you were already introduced to hold your information as independent responsible parties, and you should contact them directly to have their copies deleted.

19. Third parties who receive your information

Depending on what you ask for, your information may be disclosed to the following categories of recipient, each only to the extent needed for the stated purpose:

• verified dealerships and vehicle sourcing partners in the province you select;
• registered credit providers and finance and insurance houses attached to those dealerships;
• licensed short-term insurers and authorised financial services providers acting as brokers;
• credit bureaux and affordability-verification services, engaged by a credit provider with your authority;
• our operators, being hosting, email, analytics, error-monitoring, storage and support providers;
• our professional advisers, auditors and insurers, under duties of confidentiality;
• regulators, courts and law enforcement where disclosure is required or authorised by law.

20. Cross-border processing

Some of our operators host or process information outside South Africa. Where that happens we rely on section 72 of POPIA and put contractual data-protection terms in place requiring the recipient to apply protections substantially similar to the conditions for lawful processing under POPIA, including a prohibition on onward transfer without equivalent safeguards.

21. Security safeguards

We apply appropriate, reasonable technical and organisational measures in terms of section 19 of POPIA: encryption in transit and at rest, least-privilege and role-based access control, multi-factor authentication on administrative accounts, activity logging, dependency patching, personnel confidentiality undertakings, and tested backup and recovery procedures. Where an operator processes on our behalf, section 21 written agreements apply.

22. Notification of a security compromise

Should a compromise of your personal information occur, we will notify the Information Regulator and you as soon as reasonably possible in accordance with section 22 of POPIA, unless a public body investigating an offence directs us to delay. The notification will set out the possible consequences, the measures we are taking, and steps you can take to protect yourself.

23. Objection to processing

Where we process your information on the basis of legitimate interests, or for the protection of a legitimate interest of a third party, you may object on reasonable grounds by submitting Form 1 prescribed under POPIA, or by writing to us describing your objection. Once a valid objection is received we will stop the affected processing unless the law permits us to continue.

24. Voluntary or mandatory supply

The supply of your information is voluntary and no statute compels you to give it to us. However, certain fields are functionally necessary: contact details so that offers can reach you, province so that we can route your brief, and income and expenditure figures where a credit provider must conduct an affordability assessment under section 81 of the National Credit Act. Without those fields, the service cannot be delivered.

25. Children's information

We do not knowingly process the personal information of a child under the age of 18 without the prior consent of a competent person, as required by section 35 of POPIA. Do not submit a child's information through the Platform. If you become aware that a child's information has been submitted, tell us and we will delete it unless retention is legally required.

26. Record of processing and PAIA manual

We maintain an internal record of our processing activities, the categories of data subjects and information involved, the purposes and lawful bases, the recipients, retention periods and the safeguards applied. Our manual under the Promotion of Access to Information Act 2 of 2000 is available on request from the Information Officer at the address in section 1.